Search
Find a vulnerability
Search criteria
8 vulnerabilities by christianhelle
CVE-2026-63346 (GCVE-0-2026-63346)
Vulnerability from nvd – Published: 2026-10-30 22:17 – Updated: 2026-11-02 14:47
VLAI
EPSS
VEX
Title
Refitter: C# source injection through OpenAPI header parameter names
Summary
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:46 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/christianhelle/refitter/securi… | x_refsource_CONFIRM |
| https://github.com/christianhelle/refitter/pull/1178 | x_refsource_MISC |
| https://github.com/christianhelle/refitter/commit… | x_refsource_MISC |
| https://github.com/christianhelle/refitter/releas… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939504… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939505… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939505… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| christianhelle | refitter |
Affected:
< 2.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63346",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:46:50.420778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:47:20.841Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "refitter",
"vendor": "christianhelle",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header(\"\u003cname\u003e\")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:17:02.231Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8"
},
{
"name": "https://github.com/christianhelle/refitter/pull/1178",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/pull/1178"
},
{
"name": "https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1"
},
{
"name": "https://github.com/christianhelle/refitter/releases/tag/2.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2"
},
{
"name": "https://github.com/user-attachments/files/29395048/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395048/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29395050/make_spec.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395050/make_spec.py"
},
{
"name": "https://github.com/user-attachments/files/29395051/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395051/reproduce.sh"
}
],
"source": {
"advisory": "GHSA-58x9-vjvp-6mx8",
"discovery": "UNKNOWN"
},
"title": "Refitter: C# source injection through OpenAPI header parameter names"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63346",
"datePublished": "2026-10-30T22:17:02.231Z",
"dateReserved": "2026-07-16T14:14:24.385Z",
"dateUpdated": "2026-11-02T14:47:20.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63345 (GCVE-0-2026-63345)
Vulnerability from nvd – Published: 2026-10-30 22:13 – Updated: 2026-11-02 17:58
VLAI
EPSS
VEX
Title
Refitter: C# source injection through OpenAPI path keys
Summary
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:09 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/christianhelle/refitter/securi… | x_refsource_CONFIRM |
| https://github.com/christianhelle/refitter/pull/1178 | x_refsource_MISC |
| https://github.com/christianhelle/refitter/commit… | x_refsource_MISC |
| https://github.com/christianhelle/refitter/releas… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939522… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939522… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939523… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| christianhelle | refitter |
Affected:
< 2.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63345",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:09:18.405090Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:58:04.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "refitter",
"vendor": "christianhelle",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get(\"\u003cpath\u003e\")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1116",
"description": "CWE-1116: Inaccurate Comments",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:13:53.498Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3"
},
{
"name": "https://github.com/christianhelle/refitter/pull/1178",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/pull/1178"
},
{
"name": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973"
},
{
"name": "https://github.com/christianhelle/refitter/releases/tag/2.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2"
},
{
"name": "https://github.com/user-attachments/files/29395228/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395228/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29395229/make_spec.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395229/make_spec.py"
},
{
"name": "https://github.com/user-attachments/files/29395230/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395230/reproduce.sh"
}
],
"source": {
"advisory": "GHSA-3fhm-p725-h3g3",
"discovery": "UNKNOWN"
},
"title": "Refitter: C# source injection through OpenAPI path keys"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63345",
"datePublished": "2026-10-30T22:13:53.498Z",
"dateReserved": "2026-07-16T14:14:24.385Z",
"dateUpdated": "2026-11-02T17:58:04.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63344 (GCVE-0-2026-63344)
Vulnerability from nvd – Published: 2026-10-30 22:15 – Updated: 2026-10-30 22:15
VLAI
EPSS
VEX
Title
Refitter: C# source injection through OpenAPI content-type map keys
Summary
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
Severity
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/christianhelle/refitter/securi… | x_refsource_CONFIRM |
| https://github.com/christianhelle/refitter/pull/1178 | x_refsource_MISC |
| https://github.com/christianhelle/refitter/commit… | x_refsource_MISC |
| https://github.com/christianhelle/refitter/releas… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939484… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939485… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939485… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| christianhelle | refitter |
Affected:
< 2.1.2
|
{
"containers": {
"cna": {
"affected": [
{
"product": "refitter",
"vendor": "christianhelle",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers(\"Accept: \u003cct\u003e\", \"Content-Type: \u003cct\u003e\")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:15:27.846Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534"
},
{
"name": "https://github.com/christianhelle/refitter/pull/1178",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/pull/1178"
},
{
"name": "https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67"
},
{
"name": "https://github.com/christianhelle/refitter/releases/tag/2.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2"
},
{
"name": "https://github.com/user-attachments/files/29394848/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29394848/reproduce.sh"
},
{
"name": "https://github.com/user-attachments/files/29394851/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29394851/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29394853/make_spec.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29394853/make_spec.py"
}
],
"source": {
"advisory": "GHSA-p32v-8v8j-j534",
"discovery": "UNKNOWN"
},
"title": "Refitter: C# source injection through OpenAPI content-type map keys"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63344",
"datePublished": "2026-10-30T22:15:27.846Z",
"dateReserved": "2026-07-16T14:14:24.385Z",
"dateUpdated": "2026-10-30T22:15:27.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63184 (GCVE-0-2026-63184)
Vulnerability from nvd – Published: 2026-10-30 21:49 – Updated: 2026-11-02 14:43
VLAI
EPSS
VEX
Title
Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion
Summary
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s)` references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative `../` traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:42 UTC
CWE
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://github.com/christianhelle/refitter/securi… | x_refsource_CONFIRM |
| https://github.com/christianhelle/refitter/pull/1173 | x_refsource_MISC |
| https://github.com/christianhelle/refitter/commit… | x_refsource_MISC |
| https://github.com/christianhelle/refitter/releas… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939526… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939527… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939527… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939528… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939528… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939528… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939528… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939528… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| christianhelle | refitter |
Affected:
< 2.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63184",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:42:43.471953Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:43:07.417Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-x6w4-f264-3vvr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "refitter",
"vendor": "christianhelle",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s)` references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative `../` traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T21:49:06.793Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-x6w4-f264-3vvr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-x6w4-f264-3vvr"
},
{
"name": "https://github.com/christianhelle/refitter/pull/1173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/pull/1173"
},
{
"name": "https://github.com/christianhelle/refitter/commit/6ad20a3803561225100b0a4bb6b12f947d23db7b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/commit/6ad20a3803561225100b0a4bb6b12f947d23db7b"
},
{
"name": "https://github.com/christianhelle/refitter/releases/tag/2.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/releases/tag/2.1.1"
},
{
"name": "https://github.com/user-attachments/files/29395269/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395269/reproduce.sh"
},
{
"name": "https://github.com/user-attachments/files/29395271/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395271/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29395272/advisory.md",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395272/advisory.md"
},
{
"name": "https://github.com/user-attachments/files/29395283/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395283/reproduce.sh"
},
{
"name": "https://github.com/user-attachments/files/29395284/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395284/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29395285/advisory.md",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395285/advisory.md"
},
{
"name": "https://github.com/user-attachments/files/29395286/listener.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395286/listener.py"
},
{
"name": "https://github.com/user-attachments/files/29395288/make_spec.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395288/make_spec.py"
}
],
"source": {
"advisory": "GHSA-x6w4-f264-3vvr",
"discovery": "UNKNOWN"
},
"title": "Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63184",
"datePublished": "2026-10-30T21:49:06.793Z",
"dateReserved": "2026-07-15T22:13:00.721Z",
"dateUpdated": "2026-11-02T14:43:07.417Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63346 (GCVE-0-2026-63346)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:17 – Updated: 2026-11-02 14:47
VLAI
EPSS
VEX
Title
Refitter: C# source injection through OpenAPI header parameter names
Summary
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:46 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/christianhelle/refitter/securi… | x_refsource_CONFIRM |
| https://github.com/christianhelle/refitter/pull/1178 | x_refsource_MISC |
| https://github.com/christianhelle/refitter/commit… | x_refsource_MISC |
| https://github.com/christianhelle/refitter/releas… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939504… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939505… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939505… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| christianhelle | refitter |
Affected:
< 2.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63346",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:46:50.420778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:47:20.841Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "refitter",
"vendor": "christianhelle",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header(\"\u003cname\u003e\")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:17:02.231Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8"
},
{
"name": "https://github.com/christianhelle/refitter/pull/1178",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/pull/1178"
},
{
"name": "https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1"
},
{
"name": "https://github.com/christianhelle/refitter/releases/tag/2.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2"
},
{
"name": "https://github.com/user-attachments/files/29395048/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395048/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29395050/make_spec.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395050/make_spec.py"
},
{
"name": "https://github.com/user-attachments/files/29395051/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395051/reproduce.sh"
}
],
"source": {
"advisory": "GHSA-58x9-vjvp-6mx8",
"discovery": "UNKNOWN"
},
"title": "Refitter: C# source injection through OpenAPI header parameter names"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63346",
"datePublished": "2026-10-30T22:17:02.231Z",
"dateReserved": "2026-07-16T14:14:24.385Z",
"dateUpdated": "2026-11-02T14:47:20.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63344 (GCVE-0-2026-63344)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:15 – Updated: 2026-10-30 22:15
VLAI
EPSS
VEX
Title
Refitter: C# source injection through OpenAPI content-type map keys
Summary
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
Severity
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/christianhelle/refitter/securi… | x_refsource_CONFIRM |
| https://github.com/christianhelle/refitter/pull/1178 | x_refsource_MISC |
| https://github.com/christianhelle/refitter/commit… | x_refsource_MISC |
| https://github.com/christianhelle/refitter/releas… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939484… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939485… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939485… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| christianhelle | refitter |
Affected:
< 2.1.2
|
{
"containers": {
"cna": {
"affected": [
{
"product": "refitter",
"vendor": "christianhelle",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers(\"Accept: \u003cct\u003e\", \"Content-Type: \u003cct\u003e\")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:15:27.846Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534"
},
{
"name": "https://github.com/christianhelle/refitter/pull/1178",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/pull/1178"
},
{
"name": "https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67"
},
{
"name": "https://github.com/christianhelle/refitter/releases/tag/2.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2"
},
{
"name": "https://github.com/user-attachments/files/29394848/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29394848/reproduce.sh"
},
{
"name": "https://github.com/user-attachments/files/29394851/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29394851/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29394853/make_spec.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29394853/make_spec.py"
}
],
"source": {
"advisory": "GHSA-p32v-8v8j-j534",
"discovery": "UNKNOWN"
},
"title": "Refitter: C# source injection through OpenAPI content-type map keys"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63344",
"datePublished": "2026-10-30T22:15:27.846Z",
"dateReserved": "2026-07-16T14:14:24.385Z",
"dateUpdated": "2026-10-30T22:15:27.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63345 (GCVE-0-2026-63345)
Vulnerability from cvelistv5 – Published: 2026-10-30 22:13 – Updated: 2026-11-02 17:58
VLAI
EPSS
VEX
Title
Refitter: C# source injection through OpenAPI path keys
Summary
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:09 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/christianhelle/refitter/securi… | x_refsource_CONFIRM |
| https://github.com/christianhelle/refitter/pull/1178 | x_refsource_MISC |
| https://github.com/christianhelle/refitter/commit… | x_refsource_MISC |
| https://github.com/christianhelle/refitter/releas… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939522… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939522… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939523… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| christianhelle | refitter |
Affected:
< 2.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63345",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:09:18.405090Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:58:04.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "refitter",
"vendor": "christianhelle",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get(\"\u003cpath\u003e\")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1116",
"description": "CWE-1116: Inaccurate Comments",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:13:53.498Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3"
},
{
"name": "https://github.com/christianhelle/refitter/pull/1178",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/pull/1178"
},
{
"name": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973"
},
{
"name": "https://github.com/christianhelle/refitter/releases/tag/2.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2"
},
{
"name": "https://github.com/user-attachments/files/29395228/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395228/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29395229/make_spec.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395229/make_spec.py"
},
{
"name": "https://github.com/user-attachments/files/29395230/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395230/reproduce.sh"
}
],
"source": {
"advisory": "GHSA-3fhm-p725-h3g3",
"discovery": "UNKNOWN"
},
"title": "Refitter: C# source injection through OpenAPI path keys"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63345",
"datePublished": "2026-10-30T22:13:53.498Z",
"dateReserved": "2026-07-16T14:14:24.385Z",
"dateUpdated": "2026-11-02T17:58:04.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63184 (GCVE-0-2026-63184)
Vulnerability from cvelistv5 – Published: 2026-10-30 21:49 – Updated: 2026-11-02 14:43
VLAI
EPSS
VEX
Title
Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion
Summary
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s)` references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative `../` traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:42 UTC
CWE
Assigner
References
12 references
| URL | Tags |
|---|---|
| https://github.com/christianhelle/refitter/securi… | x_refsource_CONFIRM |
| https://github.com/christianhelle/refitter/pull/1173 | x_refsource_MISC |
| https://github.com/christianhelle/refitter/commit… | x_refsource_MISC |
| https://github.com/christianhelle/refitter/releas… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939526… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939527… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939527… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939528… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939528… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939528… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939528… | x_refsource_MISC |
| https://github.com/user-attachments/files/2939528… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| christianhelle | refitter |
Affected:
< 2.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63184",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:42:43.471953Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:43:07.417Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-x6w4-f264-3vvr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "refitter",
"vendor": "christianhelle",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s)` references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative `../` traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T21:49:06.793Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-x6w4-f264-3vvr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-x6w4-f264-3vvr"
},
{
"name": "https://github.com/christianhelle/refitter/pull/1173",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/pull/1173"
},
{
"name": "https://github.com/christianhelle/refitter/commit/6ad20a3803561225100b0a4bb6b12f947d23db7b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/commit/6ad20a3803561225100b0a4bb6b12f947d23db7b"
},
{
"name": "https://github.com/christianhelle/refitter/releases/tag/2.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/releases/tag/2.1.1"
},
{
"name": "https://github.com/user-attachments/files/29395269/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395269/reproduce.sh"
},
{
"name": "https://github.com/user-attachments/files/29395271/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395271/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29395272/advisory.md",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395272/advisory.md"
},
{
"name": "https://github.com/user-attachments/files/29395283/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395283/reproduce.sh"
},
{
"name": "https://github.com/user-attachments/files/29395284/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395284/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29395285/advisory.md",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395285/advisory.md"
},
{
"name": "https://github.com/user-attachments/files/29395286/listener.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395286/listener.py"
},
{
"name": "https://github.com/user-attachments/files/29395288/make_spec.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395288/make_spec.py"
}
],
"source": {
"advisory": "GHSA-x6w4-f264-3vvr",
"discovery": "UNKNOWN"
},
"title": "Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63184",
"datePublished": "2026-10-30T21:49:06.793Z",
"dateReserved": "2026-07-15T22:13:00.721Z",
"dateUpdated": "2026-11-02T14:43:07.417Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}